Nezuro isu takaburitsa pano pane blog iyo nhau nezve Aya, raibhurari yekugadzira eBPF madhiraivha muRust uye ndeyekuti chinangwa cheichi kugadzira vatyairi vakachengeteka kana iyo Prossimo chirongwa chekuona ndangariro yeLinux kernel ine Rust (maviri makuru mapurojekiti anozopa zvakawanda kutaura nezvazvo mumwedzi inotevera).
Uye ndizvo izvozvo mune imwe nyaya yenguva pfupi, kusagadzikana kwakasiyana kwakataurwa mariri tora mukana weetsikidzi muEBPF uye inyaya iyo vagadziri vekernel vasina kumira kushanda uye pamwe Rust ndiyo mhinduro.
Chikonzero chekubata pamusoro penyaya iyi ndechekuti nguva pfupi yadarika nhau dzakaburitswa dzavakaona "Zvimwe" kushomeka mu Linux kernel (CVE-2021-33624) kuti kupfuura kudzivirirwa kubva kune Specter-kirasi kutadza, sezvo izvi zvichibvumidza kushandisa iyo eBPF subsystem kuti ikwanise kuona zvirimo mundangariro semhedzisiro yekugadzirwa kwemamiriro ekufungidzira kwekuitwa kweamwe mashandiro.
Izvo zvinotaurwa kuti kushomeka zvinokonzerwa nekundikana mune iyo verifier, iyo inoshandiswa kuona zvikanganiso uye zvisingaite zviitiko muzvirongwa zveBPF. Iye wechokwadi anonyora nzira dzinogona kuitisa kodhi, asi anofuratira chero sarudzo dzemubazi dzisingaitwe kubva pakuona kwemurairidzo wakatemwa masematiki ekuvaka.
Paunenge uchimhanyisa chirongwa cheBPF, mabhenji sarudzo idzo dzisina kutariswa neanosimbisa dzinogona kunge dzakafanotaurwa zvisirizvo neprosesa uye ndokuitwa nenzira yekufungidzira.
Pane masisitimu akanganisika, chirongwa cheBPF chisina rukudzo chinogona kushandisa kushushikana uku kusefa zvirimo zvechisimba kernel memory (uye nekudaro zvese zvekurangarira kwepanyama) kuburikidza nedivi rerutivi.
Somuenzaniso, kana uchiongorora mashandiro e "mutoro", iyo inosimbisa inofungidzira kuti kuraira kunoshandisa rejista ine kero iyo kukosha kwayo kunogara kuri mukati memiganhu yakatarwa, asi anorwisa anogona kugadzira mamiriro pasi pazvo processor ichaedza zvekufungidzira kuita bhizinesi ine kero isinga svike nemamiriro ekuongorora.
Iyo Specter kurwisa inoda kuvepo kwechimwe chinyorwa mune yakapihwa kodhi, zvichitungamira mukufungidzira kuitiswa kwemirairo. Nekushandisa zvirongwa zveBPF zvinopfuudzwa kuti zviitwe, zvinokwanisika kuburitsa mirairo yakadai muIBPF uye kusefa zvirimo mundangariro yekernel nenzvimbo dzekupokana dzekurangarira kwepanyama kuburikidza nematanho epadivi.
Uyewo, iwe unogona kumaka katsamba nezve maitiro ekuita yemidziyo kudzivirira kubva kune Specter kirasi yekushomeka.
Iyi noti inopfupisa mhedzisiro debugger optimization rr (Record uye Replay), yakambogadzirwa neMozilla kugadzirisa zvakaoma-kudzokorora zvikanganiso muFirefox. Caching iyo system yekufona yakashandiswa kuratidza kuvepo kwemadhairekitori kwakadzora iyo "rr masosi" mashandiro epurojekiti yekuyedza kubva pamaminetsi matatu 3 masekondi kusvika masekondi makumi matatu.
Munyori wekusimudzira akasarudza kutarisa zvichachinja zvakadii kuita mushure mekuremadza kuchengetedzwa kweSpecter. Mushure mekubhowa system neparameter "mitigations = off", nguva yekuuraya ye "rr zvinyorwa" isina optimization yaive maminetsi maviri maminetsi mashanu (2 nguva nekukurumidza) uye nekugadzirisa masekondi makumi matatu nematatu (5% nekukurumidza).
Sezvineiwo, kuremadza Specter kudzivirira kwete chete yakaderedzwa nguva yekumhanya yekodhi kernel kodhi mune 1.4 nguva (kubva 2 min 9s kusvika 1 min 32s), iyo zvakare yakaganhura hafu yekuuraya nguva munzvimbo yemushandisi (kubva 1 min 9s kusvika 33s), zvinofungidzirwa nekuda kwekuderera kweiyo inoshanda CPU cache uye TLB inogadziriswazve kana Specter dziviriro ichigoneswa.
Dambudziko rave kubuda kubvira 4.15 kernel kuburitswa uye yakagadziriswa muchimiro chezvimedu, izvo izvo parizvino zvisati zvasvika kune zvese zvinogoverwa, saka zvinokurudzirwa kune vashandisi kuti mazuva ano varikugadzira iwo marongero akakodzera pavanongowana iwo ma ziviso.
Si iwe unoda kuziva zvakawanda nezvazvo, unogona kutarisa ruzivo Mune inotevera chinongedzo.